Panic when starting X with Intel KMS

[Konstantin Belousov]

On Sat, Jul 20, 2013 at 01:20:56PM +0200, Oliver Pinter wrote:
> On 7/20/13, Gustau P?rez i Querol <gperez at entel.upc.edu> wrote:
> >     Reading the backtrace I see this:
> >
> >           panic: pmap_release: pmap resident count -398580 != 0
> >
> >     which comes from amd64/amd64/pmap.c:1936. I suspect that
> > pmap->pm_stats.resident_count being negative is a bug.

The issue happened somewhere before the process exit.  Try the patch
below, the idea is that your overflow count is really big, so the
wrong-doer could cause underflow when acting.

diff --git a/sys/amd64/amd64/pmap.c b/sys/amd64/amd64/pmap.c
index 19be4e0..fcdc6af 100644
--- a/sys/amd64/amd64/pmap.c
+++ b/sys/amd64/amd64/pmap.c
@@ -465,6 +465,9 @@ pmap_resident_count_dec(pmap_t pmap, int count)
 {
 
 	PMAP_LOCK_ASSERT(pmap, MA_OWNED);
+	KASSERT(pmap->pm_stats.resident_count >= count,
+	    ("pmap %p resident count underflow %ld %d", pmap,
+	    pmap->pm_stats.resident_count, count));
 	pmap->pm_stats.resident_count -= count;
 }
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 834 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-current/attachments/20130721/3e622ba3/attachment.sig>